PT-2026-133263

CVE-2026-63414

·

Published

2026-10-29

·

Updated

2026-10-29

Description by

CVSS 4.0
7.6
High
MetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
In token-exchange authenticated controllers, shopify app exposes shop context through helpers such as current shopify domain. Prior to the fix, current shopify domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.
As a result, a request authenticated for one shop could include a different shop query parameter, causing application code to treat the requested shop as the current shop.
Applications that used current shopify domain, or the request shop parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.
The patched version hardens token-exchange handling so that:
  • current shopify domain resolves to the authenticated shop from the verified token or session.
  • authenticated shopify domain exposes the trusted authenticated shop.
  • requested shopify domain exposes the sanitized requested shop parameter for bootstrap or routing use cases only.
  • Token-exchange requests are rejected with 401 Unauthorized when the requested shop does not match the authenticated shop.

Impact

In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different shop query parameter. If the application relied on current shopify domain or params[:shop] for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.
Affected applications are those that:
  1. Use shopify app token-exchange authentication;
  2. Accept authenticated controller requests where a shop query parameter may be present; and
  3. Use current shopify domain or the request shop parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.

Remediation

Upgrade to shopify app version 23.0.3

Workarounds

Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
  • Do not use params[:shop] for authorization, tenant lookup, access-token selection, or data scoping.
  • On vulnerable versions, avoid relying on current shopify domain for security-sensitive shop scoping if a shop query parameter may be present.
  • Use the authenticated shop from the verified ID token or active Shopify session instead, such as current shopify session.shop or the verified JWT dest value.
    • If a sanitized params[:shop] value is present, reject the request with 401 Unauthorized when it does not match the authenticated shop.

Credit

This issue was responsibly reported by Hackerone researcher leqtuer.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-863: Incorrect Authorization
Related identifiers
CVE-2026-63414
GHSA-6J52-38F8-QHXR
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com